At the network layer, today's enterprise networks predominantly utilize the Internet Protocol (IP). To enhance network security at the network layer, a suite of protocols collectively referred to as IPsec was developed and is utilized along with one or more key exchange protocols as a way to provide source authentication, data integrity, and/or data confidentiality of IP datagrams transmitted in a network. In this regard, IPsec may provide end-to-end security of data in a network.
When utilizing IPsec, a source node must first establish a logical connection, known as a security association (SA), with a destination node. A security association is a unidirectional connection between the two end nodes and is characterized by the security protocol identifier (AH or ESP), the destination IP address, and a security parameter index (SPI). In this manner, the source node can transmit secure data over the network to the destination node utilizing either the Authentication Header (AH) protocol or the Encrypted Security Payload (ESP) protocol.
Although IPSec may enhance security of a network, deployment of IPSec in existing network infrastructures may be difficult and/or costly due to incompatibility of network devices and due to the fact that when data confidentiality is invoked, packet headers and/or payload may be encrypted.
Further limitations and disadvantages of conventional and traditional approaches will become apparent to one of skill in the art, through comparison of such systems with some aspects of the present invention as set forth in the remainder of the present application with reference to the drawings.